Free tools Windows power users keep installed
One-click scans. No signup required.
The Department of Justice did sue over the alleged cybersecurity failures—but that lawsuit is no longer pending. The United States filed its complaint in August 2024 against Georgia Tech Research Corporation (GTRC) and the Board of Regents of the University System of Georgia, doing business as Georgia Tech. On September 30, 2025, GTRC agreed to pay $875,000 to resolve allegations involving certain U.S. Air Force and DARPA contracts. The settlement was not an admission of wrongdoing or a judicial finding of liability.
The short version
The case concerned cybersecurity obligations attached to particular defense-research contracts performed at Georgia Tech’s Astrolavos Lab. DOJ alleged that the lab lacked a properly scoped system security plan, failed to use antivirus or antimalware protections for an extended period, and submitted a cybersecurity assessment score of 98 that did not accurately describe the covered contracting environment.
As an Amazon Associate I earn from qualifying purchases.
The allegations originated in a whistleblower lawsuit filed under the False Claims Act. The government intervened and filed its own complaint-in-intervention in August 2024. GTRC later agreed to pay $875,000, including $201,250 awarded to whistleblowers Christopher Craig and Kyle Koza. DOJ said the claims were allegations only and that the settlement did not determine liability.
What happened and when?
| Date | Event |
|---|---|
| July 8, 2022 | Craig and Koza filed the underlying qui tam complaint in United States ex rel. Craig v. Georgia Tech Research Corp. et al., No. 1:22-cv-02698, in the Northern District of Georgia. |
| February 20, 2024 | The United States intervened in the whistleblower case. |
| August 22, 2024 | DOJ filed its complaint-in-intervention against GTRC and the Board of Regents, doing business as Georgia Tech. DOJ’s announcement described the allegations. |
| December 19, 2024 | A court order dismissed the relators’ retaliation claims without prejudice. That procedural ruling was separate from a finding on the government’s core cybersecurity allegations. |
| September 29, 2025 | The parties entered the settlement agreement referenced in the joint stipulation of dismissal. |
| September 30, 2025 | DOJ announced that GTRC agreed to pay $875,000 to resolve the litigation. |
The case was therefore filed in 2024 but resolved in 2025. Describing it simply as “DOJ sues Georgia Tech” is now incomplete for readers seeking the current status.
#1 Best Overall
Who was sued?
The named defendants were not an undifferentiated “Georgia Tech.” They were:
- Georgia Tech Research Corporation: the affiliate that contracts with government agencies for research performed at Georgia Tech; and
- The Board of Regents of the University System of Georgia, doing business as the Georgia Institute of Technology.
That structure matters. GTRC is connected to Georgia Tech’s research and contracting operations; it was not described as an unrelated private cybersecurity company. The allegations concerned specific defense contracts and systems, not every Georgia Tech network, employee, laboratory, or research project.
What cybersecurity failures did DOJ allege?
1. A missing or incomplete system security plan
According to the complaint and DOJ’s public statements, the Astrolavos Lab allegedly lacked a required system security plan until at least February 2020. A system security plan documents the security controls implemented on a covered system and helps establish what environment is actually being assessed.
DOJ also alleged that the plan eventually created for the lab was improperly scoped. It allegedly omitted relevant laptops, desktops, servers, and other systems used in connection with the covered work. A plan that describes only part of the environment can create a serious gap between documented compliance and operational reality.
2. Alleged antivirus and antimalware failures
DOJ alleged that antivirus or antimalware tools were not installed, updated, or run on relevant desktops, laptops, servers, and networks until December 2021. The government also alleged that Georgia Tech approved or tolerated the lab’s refusal to install antivirus software to accommodate the preferences of the professor leading the lab.
That is an allegation from the government’s case, not an adjudicated finding. The settlement did not establish that every Georgia Tech system lacked endpoint protection or that an individual professor was personally liable.
3. The disputed cybersecurity score of 98
One of the most significant allegations involved a cybersecurity assessment score of 98, which DOJ said Georgia Tech and GTRC submitted to the Department of Defense in December 2020.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The number should not be read as “Georgia Tech had 98% security.” DOJ alleged that the score applied to a fictitious or virtual environment rather than the actual covered contracting system. The government also claimed that Georgia Tech did not operate a single campuswide information-technology system corresponding to the score.
This distinction is central: an assessment score can look strong while still being misleading if it is calculated for the wrong system boundary or excludes assets that handle covered work. DOJ said the score was required for the relevant contracts and was a condition of contract award.
Which contracts and information were involved?
The allegations concerned certain U.S. Air Force and Defense Advanced Research Projects Agency (DARPA) contracts involving sensitive cyber-defense research performed at the Astrolavos Lab.
Rank #3
That does not mean that every Georgia Tech contract, all university research, or the entire campus network was covered. The relevant obligations depended on the particular contracts, systems, information, and cybersecurity requirements at issue.
The DOJ materials also do not establish that classified information was involved. They describe sensitive or covered defense information and risks created by alleged control failures, but they do not establish that a particular breach occurred, that data was exfiltrated, or that classified information was compromised.
Why did this become a False Claims Act case?
The government asserted claims under the False Claims Act and federal common law. The case began as a qui tam action, a legal mechanism that allows private whistleblowers to sue on behalf of the United States. The government can intervene and take over litigation, as it did here.
The basic compliance theory is:
- A federal contract requires specified cybersecurity controls, documentation, or assessments.
- The contractor allegedly lacks those controls or submits an inaccurate assessment.
- The contractor seeks payment or other contract benefits.
- The government may argue that the cybersecurity representation made the resulting claim for payment false or fraudulent.
This does not mean every technical cybersecurity violation automatically creates False Claims Act liability. The legal risk depends on facts such as the contract language, the importance of the representation, what the contractor knew, whether the information was material to payment or award, and how the alleged noncompliance affected the government.
How much did Georgia Tech pay?
GTRC agreed to pay $875,000 to resolve the case. The settlement announcement says $201,250 went to the two relators, Craig and Koza, as their share of the recovery.
Recommended Free Tools
The payment should not be described as a court-imposed penalty following a finding that Georgia Tech committed fraud. DOJ expressly stated that the claims resolved by the settlement were allegations and that there had been no determination of liability. The joint stipulation of dismissal referenced the September 29, 2025 settlement agreement.
Was Georgia Tech hacked?
Not based on the DOJ materials supplied for this case. They describe alleged failures to implement and document cybersecurity controls and alleged exposure of sensitive information to risk. They do not establish a particular cyberattack, data breach, or exfiltration event resulting from those deficiencies.
That distinction matters for both legal and financial reporting. A control deficiency can create contract, regulatory, litigation, and security risk even when no publicly documented breach has occurred. But it should not be converted into a claim that the organization was hacked unless the evidence supports that conclusion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the case means for federal contractors and universities
The case illustrates why cybersecurity compliance for government contractors is more than a technical exercise. A contractor’s security plan, asset inventory, assessment score, certification, invoice, or other representation may become relevant to a payment-related fraud investigation.
Organizations handling covered defense information should consider the following controls and governance practices:
Best Value
- Map contracts to requirements. Identify the cybersecurity clauses, assessment obligations, information types, and representations attached to each contract.
- Define the real system boundary. Inventory the laptops, desktops, servers, cloud services, networks, identities, and third parties that store, process, or transmit covered information.
- Keep the system security plan current. The plan should describe the environment that actually performs the work, not an idealized or smaller environment.
- Document exceptions formally. A lab-level preference or informal waiver should not silently override a contract requirement. Exceptions should be reviewed, approved by the right authority, time-limited, and tracked to remediation.
- Support assessment scores with evidence. Preserve the asset lists, control tests, configurations, tickets, policies, and approvals that support the score submitted to the government.
- Create escalation channels. Security staff need a documented way to raise unresolved control failures to research leadership, procurement, legal, and executive decision-makers.
- Coordinate before making representations. Security, legal, contracting, research administration, finance, and procurement teams should review certifications and other compliance statements before submission.
A compliance dashboard or endpoint-security product can help collect evidence, but buying software does not make an inaccurate system boundary or assessment score accurate. The central issue is whether the organization can show that its controls and representations correspond to the actual covered environment.
How does CMMC fit into the story?
The case is relevant to the broader movement toward formal Department of Defense cybersecurity assessments, including the Cybersecurity Maturity Model Certification (CMMC) program. But it should not be called a CMMC enforcement action.
The conduct alleged in the case largely predates the current CMMC regime. The historical contract requirements, system-security-plan obligations, DoD assessment scoring, and later CMMC requirements are related parts of the defense-compliance landscape, but they are not interchangeable. A contractor should identify the specific clause and assessment obligation that applies to its contract rather than assume that a general reference to CMMC answers the question.
For current CMMC information and assessment resources, organizations should consult the Cyber-AB. For control and system-security-plan reference material, NIST SP 800-171 Rev. 2 is a primary reference, although it is not itself a managed compliance service.
What remains unclear?
The settlement resolved the litigation without a trial or liability determination. The public materials therefore do not answer every operational question a contractor or university might ask, including:
- the complete contract-by-contract financial impact;
- whether any specific data was accessed or exfiltrated;
- the precise operational changes Georgia Tech made after the alleged conduct;
- the full factual response from Georgia Tech or GTRC in the settlement materials; or
- whether separate administrative, contractual, or security proceedings occurred.
The most supportable conclusion is narrower: DOJ alleged that cybersecurity representations and controls connected to certain Air Force and DARPA work were deficient, and GTRC paid $875,000 to resolve those allegations. The settlement is a warning about system scoping, evidence, governance, and truthful government-contracting representations—not proof that all Georgia Tech systems were insecure or that a breach occurred.
Quick Recap
Sources
- DOJ settlement announcement, September 30, 2025
- DOJ complaint-in-intervention announcement, August 22, 2024
- DOJ complaint-in-intervention
- Joint stipulation of dismissal
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
